Created by Claude - please verify

Mail filtering bypasses - allow lists, spoof allows and advanced delivery. SCL -1 transport rules are on the Transport Rules page.

Required Microsoft Graph permissions

Exchange.ManageAsApp (+ Security Reader in Exchange for the Tenant Allow/Block List) — application permission, granted to the app registration with admin consent.

Licence: Exchange Online Protection (every tenant). Advanced delivery rows need Defender for Office 365 or appear empty.

Endpoints: Get-TenantAllowBlockListItems -Allow (Sender, Url, FileHash) · Get-TenantAllowBlockListSpoofItems -Action Allow · Get-HostedContentFilterPolicy (AllowedSenders, AllowedSenderDomains) · Get-HostedConnectionFilterPolicy (IPAllowList, EnableSafeList) · Get-ExoSecOpsOverrideRule · Get-ExoPhishSimOverrideRule

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Mail Filtering Bypasses

Every allow entry is a hole in the filter: mail matching it is delivered even when Microsoft thinks it is spam or phishing. Allowed domains in the anti-spam policy are the worst - anyone can spoof them. This report lists every bypass with its age and last use.